# Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor via PowerShell and TON Blockchain C2 (EtherHiding-style)

> A multi-stage campaign uses Windows .LNK shortcut files disguised as images (photo-*.png.lnk, IMG-*.png.lnk) delivered via booking-themed spam and Google Share links targeting hotels and travel businesses. The LNK runs obfuscated PowerShell that downloads a legitimate Node.js v24.13.0 runtime, decrypts a VM-interpreter-based JavaScript backdoor, installs Registry Run-key persistence, attempts a Microsoft Defender exclusion, and resolves its live C2 domain by querying a TON blockchain smart contract (EtherHiding-style resilient C2).

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1178
- **ID:** TL-2026-1178
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The campaign begins with malicious ZIP archives containing .lnk files that borrow icons from shell32.dll to masquerade as image files (photo-*.png.lnk / IMG-*.png.lnk). Victims are lured via booking-themed spam email and shortened Google Share links (hxxps://share.google/YLoRYlokrW3iner8r) that redirect to attacker infrastructure (hxxps://recordstrace[.]info/5bC6vVOeP9PI3B08); early samples were also seeded as comments on public discussion/economics forums.

Double-clicking the LNK triggers an obfuscated PowerShell one-liner. Two obfuscation variants were identified: one using bitwise operations (-band 255, -shr 8) and one using arithmetic equivalents (modulo 256, integer division) to reconstruct the destination C2 hostname from encoded integers at runtime, keeping the true destination invisible in the shortcut's plaintext target field.

If Node.js is not already present, the PowerShell downloads the genuine, unmodified Node.js v24.13.0 Windows x64 distribution directly from nodejs.org (https://nodejs.org/dist/v24.13.0/node-v24.13.0-win-x64.zip), unpacks it under %LOCALAPPDATA%, then Base64-decodes and AES-128-CBC-decrypts an accompanying JavaScript payload. Abusing a legitimate, signed runtime as the execution host lowers the odds of AV/EDR flagging the process tree and is itself a masquerading technique (T1036.005).

The JavaScript payload is heavily scrambled and implements a custom bytecode virtual-machine interpreter (internally referenced as a vmn_c51b70-style function) that decodes and executes 32 Base64-encoded instruction blobs at runtime rather than running plain JavaScript logic, substantially hindering static analysis. The backdoor checks for and avoids duplicate execution, then installs persistence via an HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry value that relaunches node.exe detached, with its window hidden and stdout/stderr suppressed, on every logon. Before executing any additional downloaded binaries, the malware attempts to add a Windows Defender process exclusion via an Add-MpPreference -ExclusionProcess "<path>" command, disabling AV inspection of its own components.

For command-and-control, the backdoor does not hardcode a C2 domain. Instead it queries the TON blockchain via the public TONAPI service (https://tonapi.io/v2/blockchain/accounts/0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9/methods/get_domain) to retrieve the current, operator-controlled C2 hostname from smart-contract transaction data — an EtherHiding-style technique previously documented on BNB Smart Chain/Ethereum and now observed leveraging TON. Because the smart contract's stored value can be updated at any time by the operator without touching the malware binary itself, defenders cannot disrupt the campaign by seizing or sinkholing a single domain; historical contract transactions show the resolved domain rotating across dozens of throwaway domains (tonajukbhuakpo2[.]shop, zloapobikahy23[.]bond, hsaertyuoang34[.]sbs, amanohuguta[.]cfd, and 30+ others) between February and June 2026.

Once a live C2 hostname is resolved, the backdoor opens a WebSocket connection (wss://<c2>/w?user_id=<guid>), performs an ECDH secp256k1 key exchange with the server, and derives a shared AES-256-CBC key/IV via HKDF for subsequent encrypted command traffic — layering standard-port-agnostic WebSocket transport (T1571) on top of the blockchain-resolved fallback channel (T1008).

Security researchers (LevelBlue SpiderLabs) discovered the activity while investigating a customer alert and correlated more than 400 LNK samples back to a single shared MachineID value (win-5r0dsv23ed0), with the earliest samples dating to approximately March 2026 and new samples still appearing daily as of the July 2026 publication — indicating a large, ongoing, centrally operated campaign rather than isolated spam. Targeting is concentrated on hotels and travel/booking-related businesses via booking-themed lures, consistent with a financially-motivated initial-access or fraud operation, though no threat actor has been publicly attributed at this time.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1008 Fallback Channels
- T1102.002 Bidirectional Communication
- T1573.001 Symmetric Cryptography
- T1132.001 Standard Encoding

## Sources

- [Malicious Windows Shortcuts Use PowerShell and Node.js](https://cybersecuritynews.com/malicious-windows-shortcuts-use-powershell-and-node-js/)
- [Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.js Backdoor](https://www.levelblue.com/blogs/spiderlabs-blog/hiding-in-the-chain-multi-stage-lnk-attack-leveraging-ton-blockchain-to-deliver-node.js-backdoor)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution](https://www.picussecurity.com/resource/blog/etherhiding-how-web3-infrastructure-enables-stealthy-malware-distribution)
- [Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum](https://cybersecuritynews.com/hackers-use-etherrat-and-etherhiding/)
- [The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain](https://www.endorlabs.com/learn/the-unkillable-c2-how-attackers-are-moving-command-and-control-to-the-blockchain)
- [Potential Etherhiding C2 via Blockchain Connection](https://www.elastic.co/guide/en/security/8.19/potential-etherhiding-c2-via-blockchain-connection.html)
- [Uncovering EtherHiding: Malware Hidden in Blockchain](https://cymulate.com/blog/simulating-etherhiding-blockchain-as-a-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1178